Want a Cyber Security Job But Know Zero? Will a Fake LinkedIn Profile Help You?
October 17, 2022
LinkedIn has unwittingly become a vector for the spread of false information. Krebs on Security reports, “Fake CISO Profiles on LinkedIn Target Fortune 500s.” A slew of fake LinkedIn profiles mysteriously appeared for Chief Information Security Officers purportedly serving at high-profile companies. Some were entirely original fabrications, but at least one lifted a description from the actual CISO’s profile. See the write-up for screenshots of a few offending profiles.
Who is fooled? Organizations looking for cybersecurity professionals. And not just on LinkedIn. Apparently other sources unwittingly perpetuated the lies, sources like Google Search, Apollo.io, Signalhire, Cybersecurity Ventures, and Cybercrime Magazine’s CISO 500 list. Whoever is behind the effort must have been delighted. It was apparently Honeywell’s former CISO Rich Mason who first noticed the trend and sounded the alarm. Krebs notes:
“Again, we don’t know much about who or what is behind these profiles, but in August the security firm Mandiant (recently acquired by Google) told Bloomberg that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at crypto currency firms. None of the profiles listed here responded to requests for comment (or to become a connection). In a statement provided to KrebsOnSecurity, LinkedIn said its teams were actively working to take these fake accounts down.”
We are sure they are. The article suggests some ways the site could make things easier on themselves in the future. Maybe even catch and remove such fabrications before they make it to other media channels. We are told:
“LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a ‘created on’ date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications. The former CISO Mason said LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer. … Mason said LinkedIn also needs a more streamlined process for allowing employers to remove phony employee accounts.”
It is unlikely that we’ve seen the last of this tactic. LinkedIn should bolster its safeguards and streamline its reporting process. Meanwhile, other sources must learn to verify information they find on the site. Safeguarding one’s reputation for accurate data should be worth the effort.
Cynthia Murrell, October 17, 2022
Microsoft Teams and Sensitive Information
October 13, 2022
I read a somewhat unusual analysis of Microsoft Teams security. “Microsoft Teams Users Are Using It for a Really Bad Reason, So Stop Now” presents some data about Teams’ users and their sending information over the system. Now the purpose of Teams and similar conferencing software is to exchange information. Therefore, access to Teams sessions and the data exchanged while using the using may have some value to certain individuals if such access were available.
Okay, now let’s look at some of the numbers in the write up:
- 45 percent of those in the sample (who knows how many were in the sample by the way?) “admit to sending confidential and sensitive information frequently via Microsoft Teams.” Now let’s think about this. Does this mean that 55 percent of those using Teams do not provide “confidential or sensitive information”? Is this a measure of productivity which Teams enhances?
- 51 percent were found to be “sharing business critical information.” I am not sure I understand the distinctioin between “sensitive” and “business critical. The idea that half of those using Teams don’t share important data.
- 56 percent believe training is needed.
Net net: Microsoft may have to do more than silence Teams’ blowhards. See “Microsoft Is Working Hard to Shut Up the Egotistical Blowhard on Your Team.”
Stephen E Arnold, October 15, 2022
Russia: Inconsistent Cyber Attack Capabilities
October 7, 2022
Do you remember that Microsoft’s president Brad Smith opined that the SolarWinds’ misstep required about 1,000 engineers? I do. Let’s assume those engineers then turned their attention to compromising Ukraine as part of a special military operation.
“Failure of Russia’s Cyber Attacks on Ukraine Is Most Important Lesson for NCSC” presents information I found interesting about Mr. Smith’s SolarWinds’ remark. [The NCSC is the United Kingdom’s National Cyber Security Council.’
Here’s the key passage from the write up:
Ukrainian cyber defences, IT security industry support and international collaboration have so far prevented Russian cyber attacks from having their intended destabilising impact during Russia’s invasion of Ukraine.
The write up also points out that a cyber content marketing campaign designed to undermine Ukraine’s leadership was also not effective.
Okay, but, Mr. Smith said that Russia was able to coordinate the efforts of 1,000 individuals to breach SolarWinds’ security and create considerable distress among some in commercial enterprises and other organizations.
How could Ukraine resist this type of capable force? I have no idea. I prefer to flip the information around and ask, “Why did SolarWinds’ security yield so easily?” Did Russia put more effort into breaching SolarWinds than fighting a kinetic war? Yeah, sure it did.
Maybe the 1,000 programmer idea was hand waving and blame shifting? Microsoft cannot make printers work. Why would Microsoft security be much better?
Stephen E Arnold, September 2022
Microsoft Teams: Ho Ho Ho
September 30, 2022
That Microsoft Teams is something. I refuse to use it. Others have to use it. I am happy with Zoom. I am fortunate. I can dictate what video tool I use. You? No. Too bad. I try not to think about Teams. I admit to sending my son notices of new Teams’ features, and he has a great sense of humor and sends me smiley faces as a reply. I am not sure he is smiling inside, however.
I noted that Teams popped up in a link to a YCombinator discussion “Why Is Microsoft Teams Still So Bad?.” The comments are informative and interesting; for example:
- Roydivision says: Random crashing.
- Classified says: Once the bean counters discover that you can make money with a piece of software, the game is over.
- M4lvin says: In Germany (or maybe whenever the system language is German) Microsoft decided that everyone should have a Ferris wheel and a bezel in their task bar because now it is Oktoberfest in Munich. Seriously? I think we have reached spam-as-an-operating-system.
- Yawnxyz says: Microsoft product suites are like the Olive Garden of the product world.
- Cyberge99 says: I think Teams also offers more capabilities to Enterprise users. I’ve been on a few teams calls with people on the call that are not visible in the attendee list.
What’s interesting is that:
- People complain but organizations use Microsoft products due to pricing, compliance, institutional momentum, security assertions, familiarity, etc. (Does this mean “monopoly”?)
- Microsoft seems to be assembling a communications equivalent to Word; that is, many features, some of which do not work or cannot be located by a user not intimately familiar with the application. (Is this terminal featuritis?)
- Microsoft’s assertions to the media are not fact checked; otherwise, the comments in the cited thread might be less creditable. (Does science fiction count as a technology deliverable?)
I found the question interesting, but the comments speak more effectively than an equivalent number of TikToks. Viva Teams!
Stephen E Arnold, September 30, 2022
Board Games at Microsoft? Maybe Corner Cutting?
September 30, 2022
I noted a write up called “Anonymous Lays Waste to Russian Message Board, Releases Entire Database Online.” The article describes what a merrie band of anonymous, distributed bad actors can do in today’s decentralized, Web 3 world of online games like Cat and Mouse. The article explains that Mr. Putin’s bureaucracy is a big, fat, and easy target to attack. One statement in the article caught my attention; to wit:
For all their reputation on cyber security and hacking, the Russians were careless…. KiraSec has taken down hundreds of Russian websites, Russian banks like alfabank, bank.yandex.ru, pro-Russian terror-leaning websites, Russian pedophile websites, Russian government websites, Russian porn sites and a lot more. The cyber activists also “hacked various Russian SCADAs and ICS, nuking their systems and completely destroying their industrial machines.”
I immediately thought about Microsoft’s Brad Smith suggesting that more than 1,000 programmers worked to make SolarWinds a household word. My thought was that Microsoft itself may share the systems engineering approach used to protect some Russian information assets. The key word is “careless.” Arrogance, indifference, and probably quite terrible management facilitated the loss of Russian data and the SolarWinds’ misstep.
I then spotted in my news headline stream this article from the UK online outfit The Register: “Excel’s Comedy of Errors Needs a New Script, Not New Scripting.” This article points out that Microsoft has introduced a new feature for Excel. I am not an individual who writes everything in Excel, including holiday greetings and lists of government officials names and email addresses. Some are.
Here’s the passage I circled after I printed out the write up on a piece of paper:
Excel is already the single most dangerous tool to give to civilians. You can get things wrong in Word and PowerPoint all day long, and while they have their own security fun you’re not getting things wrong through a series of tiny letterboxes behind which can live the company’s most important numerical data. The Excel Blunder is its own genre of corporate terror: it brings down companies, it breaches data like a excited whale seeking sunlight, it can make a mockery of pandemic control. And because Excel is the only universal tool most users get for organizing any sort of data, the abuses and perversions it gets put to are endless.
What’s the connection between bad actors hacking Russia, Microsoft’s explanation of the SolarWinds’ misstep, and Excel’s new scripting method?
Insecurity appears to be part of the core business process.
No big deal. Some bad actors and a few cyber security vendors will be happy. Others will be “careless” and maybe clueless. That’s Clue the board game, not the motion picture.
Stephen E Arnold, September 30, 2022
Microsoft Viva: Live to Work, Work to Live
September 29, 2022
I read about a weird Microsoft innovation. No, it’s not about security. No, it’s not about getting a printer to work in Windows 11. No, it’s not about the bloat in Microsoft Edge. And — at least not yet — it’s not about the wild and extremely wonderful world of Microsoft Teams.
The title of the article in Computerworld is “Microsoft Viva Enhancements Address Employee Disconnect in Hybrid Work Environments.” After explaining why humans invented an office or factory to which employees went to complete tasks, the author provides to illustrate why the work from home approach is not a productivity home run. Employees like to get paid and fiddle around. Work is often hard. (I did spot one Italian government employee sitting in a one room office in Sienna doing absolutely nothing. I checked on the fellow three times over three days. Nothing. No visitors. No phone buzzing. Not even a computer in site. Now that’s a reliable worker… doing nothing with style.)
Let’s get to the Microsoft inventions, shall we?
The product/service is Microsoft Viva and it has the usual Redmond touch. There is Viva Pulse and there is Viva Amplify.
What’s up?
According to the write up:
Viva Pulse is designed to enable managers and team leaders to seek regular and confidential feedback on their team’s experience, using smart templates and research-backed questions to help managers pinpoint what’s working well, where to focus, and what actions could be undertaken to address team needs.
And next up:
Viva Amplify is meant to improve communication between leaders and employees. The app centralizes communications campaigns, offers writing guidance to improve message resonance, enables publishing across multiple channels and distribution groups in Microsoft 365, and provides metrics for improvement.
Other extensions may be Viva Answers, Viva Leadership Corner, Viva Engage, and my personal favorite People in Viva.
These products include Microsoft smart software which will perform such managerial magic as answer employee questions. Also the systems will put “collective knowledge to work for all employees.” (I love categorical affirmatives, don’t you. So universal.) There will be a Leadership Corner where employees “can interact directly with leadership, share ideas and perspectives, participate in organization initiatives, and more.”
Okay, I can’t summarize any more.
My take on this is that Microsoft got a group of 20 somethings together, possibly in a coffee shop, and asked them to conjure up a way for employees working on a project in their jammies to communicate. The result is Viva, and it will be pitched by certified partners to big customers as a productivity enhancement tool. If I were trying to sell this to a government agency, I would say, “This is an umbrella under which Teams can operate. Synergy. Shazam! Oh, the first year is free when you renew your existing Microsoft licenses.”
My concern is that the:
- Viva construct will expand the attack service for bad actors
- The numerous moving parts will not move in the way users expect
- Managers will find learning the constantly updating Viva components time consuming and just go walk to phone calls and managing by walking around.
Great innovation? Hardly. To Microsoft, however, this is the equivalent to discovering a new thing to sell and distract people from some of Microsoft’s more interesting issues. Example: Security challenges.
Stephen E Arnold, September 29, 2022
LinkedIn: The Logic of the Greater Good
September 26, 2022
I have accepted two factoids about life online:
First, the range of topics searched from my computer systems available to my research team is broad, diverse, and traverses the regular Web, the Dark Web, and what we call the “ghost Web.” As a result, recommendation systems like those in use by Facebook, Google, and Microsoft are laughable. One example is YouTube’s suggesting that one of my team would like an inappropriate beach fashion show here, a fire on a cruise ship here, humorous snooker shots here, or sounds heard after someone moved to America here illustrate the ineffectuality of Google’s smart recommendation software. These recommendations make clear that when smart software cannot identify a pattern or an intentional pattern disrupting click stream, data poisoning works like a champ. (OSINT fans take note. Data poisoning works and I am not the only person harboring this factoid.) Key factoid: Recommendation systems don’t work and the outputs can be poisoned… easily.
Second, profile centric systems like Facebook’s properties or the LinkedIn social network struggle to identify information that is relevant. Thus, we ignore the suggestions for who is hiring people with your profile and the requests to be friends. These are amusing. Here are some anonymized examples. A female in Singapore wanted to connect me with an escort when I was next in Singapore. I interpreted this as a solicitation somewhat ill suited to a 77 year old male who no longer flies to Washington, DC. Forget Singapore. What about a person who is a sales person at a cable company? Or what about a person who does land use planning in Ecuador? What about a person with 19 years experience as a Google “partner”? You get the idea. Pimps and resellers of services which could be discontinued without warning. Key factoid: Recommendations don’t match that I am retired, give lectures to law enforcement and intelligence professionals, and stay in my office in rural Kentucky, with my lovable computers, a not so lovable French bulldog, and my main squeeze for the last 53 years. (Sorry, Singapore intermediary for escorts. 
)
I read a write up in the indigestion inducing New York Times. I am never sure if the stories are accurate, motivated by social bias, written by a persistent fame seeker, or just made up by a modern day Jayson Blair. For info, click here. (You will have to pay to view this exciting story about fiction presented as “real” news.
The story catching my attention today (Saturday, September 24, 2022) has the title “LinkedIn Ran Social Experiments on 20 Million Users over Five Years?” Obviously the author is not familiar with the default security and privacy settings in Windows 10 and that outstanding Windows 11. Data collection both explicit and implicit is the tension in in the warp and woof of the operating systems’ fabric.
Since Microsoft owns LinkedIn, it did not take me long to conclude that LinkedIn like its precursor Plaxo had to be approached with caution, great caution. The write up reports that some Ivory Tower types figured out that LinkedIn ran and probably still runs tests to determine what can get more users, more clicks, and more advertising dollars for the Softies. An academic stalking horse is usually a good idea.
I did spot several comments in the write up which struck me as amusing. Let’s look at a three:
First, consider this statement:
LinkedIn, which is owned by Microsoft, did not directly answer a question about how the company had considered the potential long term consequences of its experiments on users’ employment and economic status.
No kidding. A big tech company being looked at for its allegedly monopolistic behaviors not directly answering a New York Times’ reporters questions. Earth shaking. But the killer gag for me is wanting to know if Microsoft LinkedIn “consider the potential long term consequences of its experiments.” Ho ho ho. Long term at a high tech outfit is measured in 12 week chunks. Sure, there may be a five year plan, but it probably still includes references to Microsoft’s network card business, the outlook for Windows Phone and Nokia, and getting the menus and icons in Office 365 to be the same across MSFT applications, and pitching the security of Microsoft Azure and Exchange as bulletproof. (Remember. There is a weapon called the Snipex Alligator, but it is not needed to blast holes through some of Microsoft’s vaunted security systems I have heard.)
Second, what about this passage from the write up:
Professor Aral of MIT said the deeper significance of the study was that it showed the importance of powerful social networking algorithms — not just in amplifying problems like misinformation but also as fundamental indications or economic conditions like employment and unemployment.
I think a few people understand that corrosive, disintermediating impact of social media information delivered quickly can have an effect. Examples range from flash mob riots to teens killing themselves because social media just does such a bang up job of helping adolescents deal with inputs from strangers and algorithms which highlight the thrill of blue screening oneself. The excitement of asking people who won’t help one find a job is probably less of a downer but failing to land an interview via LinkedIn might spark binge watching of “Friends.”
Third, I loved this passage:
“… If you want to get more jobs, you should be on LinkedIn more.
Yeah, that’s what I call psychological triggering: Be on LinkedIn more. Now. Log on. Just don’t bother to ask me to add you my network of people whom I don’t know because “Stephen E Arnold” on LinkedIn is managed by different members of my team.
Net net: Which is better? The New York Times or Microsoft LinkedIn. You have 10 minutes to craft an answer which you can post on LinkedIn among the self promotions, weird facts, and news about business opportunities like paying some outfit to put you on a company’s Board of Advisors.
Yeah, do it.
Stephen E Arnold, September 26, 2022
AI Humorously Trolls With Fake LinkedIn Profiles
September 14, 2022
Does anyone take anything on LinkedIn seriously anymore? Beyond cringy posts, scammers use bots to make fake profiles. Bad actors are not the only ones who enjoy poking fun at LinkedIn. Business Insider explains how an AI was designed to create the best sh*ts and giggles to share on the platform: “The Internet Is Having A Field Day With This AI Tool That Pokes Fun At LinkedIn By Making Cringy, Aspirational Posts Celebrating Even The Most Mundane Tasks.”
The Viral Post Generator is an AI tool that creates genius, cringe worthy inspirational advice with buzzwords, jargon, and all the spicy goodness of a wordsmith who can write a beautiful description of rotting trash. The Viral Post Generator works by typing in an activity, then it pops out a less than savory, but inspirational post.
Tom Orbach is a growth marketing manager at the Israeli privacy tech startup Mine. He scraped over 10,000 of LinkedIn’s popular posts and discovered they were mostly self-centered, even a tad narcissistic. He made the Viral Post Generator to make fun of LinkedIn, but Orbach loves LinkedIn:
“’It’s my favorite social network, and I like how positive it is, but it’s just too cringy from time to time,’ Orbach said. ‘I just think that people should be more real and authentic and think of themselves less as thought leaders and more as colleagues. He continued: ‘The posts that go viral are usually narcissistic ones, but it doesn’t have to be that way.’”
Orbach wants people to be more authentic. Hopefully, Orbach will not lose that sense of wonder and trust in humanity, because the Internet kills that within seconds. And what about Microsoft’s smart software bird dogging LinkedIn? Yeah, really.
Whitney Grace, September 14, 2022
Microsoft: Explaining Its Cloud Policies and Revealing Its Thought Processes
September 12, 2022
After I graduated from a so so university, some other academic entity paid me money to work on a PhD. As part of the deal, I had to teach one class in freshman composition. The students were working like pious beavers to become nuns, priests, and I suppose capable professionals in a religious bookstore or some similar line of work.
I read some wild and crazy essays: Truth: The Path to Salvation, Faith: The Rock in the Thunderstorm of Life, etc etc. I was transported back to my small apartment behind a big estate type house and correcting the type of errors Grammarly eliminates. No computers in 1967 that would fit in my roomy 700 square feet.
The essay which caught my attention is — in modern lingo — a blog post. Its title lacks the metaphorical impact of those freshman essays but the content is quite remarkable.
First, the title: “New Licensing Benefits Make Bringing Workloads and Licenses to Partners’ Clouds Easier.” The main idea is that Microsoft wants to demonstrate that it is not really a quasi-monopoly. Nope, it learned its lesson when Mr. Gates’ testimony successfully thwarted the US government decades ago. Who knew he was a gifted rhetorician or a word-meister capable of The Road Ahead?
The blog title is interesting because it talks about benefits. The idea that Microsoft wants to make life easier. You know. Just like the Windows 11 changes for the corporations who deploy the operating systems to one or two employees. No big deal. Just add annoyances and kill printing. But the payoffs addressed in the blog “essay” requires some linguistic calisthenics.
Here’s a sampling:
CSP or cloud solution provider
Easier
Ecosystem
Empower
Ensure
Excited
Exciting
Flexible virtualization
Hosted
Joint success
Outsourcers
QMTH or qualified multitenant hosting
QOS or qualifying operating system
SPLA or service provider licensing agreements
Scenarios
Virtual core
Workloads
What does the word choice suggest? To me, I am suspicious. How can a giant corporation with a stellar track record of delivering software which often does not work care so much about a provider. What is a provider. A good shepherd, a rock in a storm, a beacon to salvation?
Third, I noted a fascinating but very tiny asterisk in the section title “More Flexibility and Options for Software Outsourcing.” The asterisk points to the foot of the blog essay. Listed at that point are the companies not allowed to get paid to let customers put Microsoft software on these alien, and apparently inappropriate computer systems. You want multi cloud? You want freedom to run the software for which you pay where to want to run it? Ho ho ho. Not unless a regulator shows some moxie.
Who are the dark and threatening cloudies? Here’s the list with the tiny asterisk:
- Alibaba
- Amazon Web Services
- Microsoft.
See, Microsoft puts Microsoft on its own list. How can a giant company be more fair? Impossible to out do this path to salvation.
Fourth, information which strikes me as important appears toward the end of the blog post; to wit:
At its inception, SPLA was intended to allow partners to offer hosted services from their own datacenters, not for managed service providers buying through SPLA to host on others’ datacenters. We are making changes to the SPLA program, starting in October 2022, to better align with the program’s intent, and with other commercial licensing programs.
Observations:
- Microsoft is scrambling to be on the side of its partners and customers but, to me, mostly the customers
- The European Union is likely to be confused by the language of the blog post but will muddle through and continue the crackdown on the US technology companies and their business practices
- The Microsoft partners need to generate revenue with Microsoft generating leads, engineering service opportunities, and positioning that maximizes the benefit of many happy Windows, Word, and Teams users.
Net net: Not an F, but I would score the write up as a C minus or D plus. The split infinitive in the blog post was bad. But the tiny asterisk and red lining estimable companies like Alibaba, Amazon, and Google. Clumsy clumsy.
Stephen E Arnold, September 12, 2022
Microsoft: A Better PDF?
August 23, 2022
I am not a fan of the Adobe Trapeze (now known as Acrobat). The dongles, the font handling, and the lack of a function to “destroy document” at a specific date and time convinced me that PDF really meant “poor document format.” That was in 1989 I think. As if the Adobe cross platform document rendering mechanism was not exciting enough, Microsoft decided it could create a better solution. Hey, pair that puppy with Visio, and you have a darned exciting combination.
I read “Microsoft Confirms Problems with Opening XPS Documents in Windows 10 and 11.” The write up states:
Besides the inability to open XPS and OXPS documents in non-English languages, XPS Viewer stops responding and starts hogging CPU and RAM resources until it crashes upon reaching 2.5GB of RAM usage.
The article seems mostly unconcerned with this minor problem.
My view is that it may not make much difference. If an XPS document renders, it might be difficult to print. You know the persistent USB printer thing.
Remarkable and consistent excellence in software engineering. I am not worried. I know that Windows Defender and its off spring are 100 percent rock solid. Don’t you?
Stephen E Arnold, August 23, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
